LayerZero links the KelpDAO hack to the Lazarus group

KelpDAO’s cross‑chain bridge was drained of about $292 million on April 19, 2025, after attackers withdrew 116,500 rsETH. LayerZero attributes the “surgically precise” exploit to North Korea’s Lazarus group (TraderTraitor), saying attackers manipulated the bridge’s single verification checkpoint rather than the vault itself. The incident exposed a known architectural flaw — reliance on one verifier — that LayerZero had repeatedly warned KelpDAO to fix. Aave froze rsETH-linked markets, producing an immediate liquidity shock that removed over $10 billion from the protocol; hackers almost took an additional ~$100 million before being blocked. The attack is part of a string of large Lazarus operations (Bybit, Drift) and underscores systemic bridge risk in DeFi, increasing short‑term downside risk and counterparty/security concerns across cross‑chain liquidity and staking markets.